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Why GAO Did This Study 

Hurricane Katrina illustrated that 
effective preparation and response 
to a catastrophe requires a joint 
effort between federal, state, and 
local government. The Department 
of Homeland Security (DHS), 
through the Federal Emergency 
Management Agency (FEMA), is 
responsible for heading the joint 
effort. In January 2008, DHS 
released the National Response 
Framework (NRF), a revision of 
the 2004 National Response Plan 
(2004 Plan), the national 
preparation plan for all hazards. In 
response to the explanatory 
statement to the Consolidated 
Appropriations Act of 2008 and as 
discussed with congressional 
committees, this report evaluates 
the extent to which (1) DHS 
collaborated with non-federal 
stakeholders in revising and 
updating the 2004 Plan into the 
2008 NRF and (2) FEMA has 
developed policies and procedures 
for managing future NRF revisions. 
To accomplish these objectives, 
GAO reviewed DHS and FEMA 
documents related to the revision 
process, analyzed the relevant 
statutes, and interviewed federal 
and non-federal officials who held 
key positions in the revision 
process. 



What GAO Recommends 



GAO recommends that FEMA 
develop policies and procedures 
that guide how future revision 
processes will occur, particularly 
for collaborating with non-federal 
stakeholders. 

FEMA concurred with our 
recommendation. 

To view the full product, including the scope 
and methodology, click on GAO-08-768. 
For more information, contact William Jenkins 
at (202) 512-8757 orJenkinsWO@gao.gov. 



What GAO Found 

While DHS included non-federal stakeholders — state, local, and tribal 
governments, nongovernmental organizations, and the private sector — in the 
initial and final stages of revising the 2004 Plan into the NRF, it did not 
collaborate with these stakeholders as fully as it originally planned or as 
required by the October 2006 Post-Katrina Emergency Management Reform 
Act (Post-Katrina Act). As the revision process began in 2006, DHS involved 
both federal and non-federal stakeholders by soliciting and incorporating their 
input in determining the key revision issues and developing the first draft in 
April 2007. However, after this first draft was completed, DHS deviated from 
its revision work plan by conducting a closed, internal federal review of the 
draft rather than releasing it for stakeholder comment because the draft 
required further modifications DHS considered necessary. DHS limited 
communication with non-federal stakeholders until it released a draft for 
public comment 5 months later on September 10, 2007. The following day, 
non-federal stakeholders testified at a congressional hearing that DHS had 
shut them out during that 5-month period. In addition, the Post-Katrina Act 
required that DHS establish a National Advisory Council (NAC) for the FEMA 
Administrator by December 2006 to, among other things, incorporate non- 
federal stakeholders' input in the revision process. However, FEMA stated the 
necessary time to select quality NAC members required additional time, and 
FEMA did not announce the NAC's membership until June 2007. The NAC did 
not provide comments on a revision draft until one month before DHS 
publicly released the final NRF in January 2008. 

FEMA anticipates that the NRF will be revised in the future; however, FEMA 
does not have policies or procedures in place to guide this process or ensure a 
collaborative partnership with stakeholders. FEMA has emphasized the 
importance of partnering with relevant stakeholders to effectively prepare for 
and respond to major and catastrophic disasters, and the Congress, through 
the Post-Katrina Act, requires such partnership. In addition, the Standards for 
Internal Controls in the Federal Government calls for policies and 
procedures that establish regular communication with stakeholders and 
monitor performance over time as essential for achieving desired program 
goals. Furthermore, previous GAO work on the Department of Defense's civil 
support plans and the administration's national pandemic influenza 
implementation plan has shown the need for participation of state and local 
jurisdictions in emergency planning. Especially in view of a new 
administration, the experience of the previous revision process illustrates the 
importance of collaborating with stakeholders in revising a plan that relies on 
them for its successful implementation. While the NRF is published by DHS, it 
belongs to the nation's emergency response community. Developing such 
policies and procedures is essential for ensuring that FEMA attains the Post- 
Katrina Act's goal of partnering with non-federal stakeholders in building the 
nation's emergency management system, including the periodic review and 
revision of the NRF. 
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^ G A O 

— Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



June 11, 2008 

The Honorable Robert C. Byrd 
Chairman 

The Honorable Thad Cochran 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
United States Senate 

The Honorable David E. Price 
Chair 

The Honorable Harold Rogers 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

A common axiom in emergency management is that "All disasters are 
local." But a key lesson Hurricane Katrina dramatically emphasized was 
that major disasters can quickly overwhelm the capacity of local 
responders. Thus, preparing for, responding to, and recovering from major 
disasters requires partnerships between the federal government and non- 
federal stakeholders, such as state, local, and tribal governments, the 
private sector, and nongovernmental organizations. In summarizing the 
lessons learned from our nation's response to Katrina, we reported in 
September 2006 that these federal and non-federal partnerships were 
critical to improving catastrophic disaster response. 1 The 2006 Post- 
Katrina Emergency Management Reform Act (Post-Katrina Act) 2 
specifically tasked the Federal Emergency Management Agency (FEMA) 
within the Department of Homeland Security (DHS) to partner with these 
non-federal stakeholders to build a national system of emergency 
management. In outlining his vision for a "New FEMA" and in testimonies 



1 GAO, Catastrophic Disasters: Enhanced Leadership, Capabilities, and Accountability 
Controls Will Improve the Effectiveness of the Nation's Preparedness, Response, and 
Recovery System, GAO-06-618 (Washington, D.C.: Sept. 6, 2006). 

2 The Post-Katrina Act was enacted as Title VI of the Department of Homeland Security 
Appropriations Act, 2007, Pub. L. No. 109-295, 120 Stat. 1355 (2006). 
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before the Congress, the FEMA Administrator has acknowledged that 
FEMA's success depends on its ability to establish and maintain robust 
partnerships with non-federal stakeholders. 

DHS issued the National Response Plan in December 2004 (2004 Plan) to 
provide common principles and structures to align the efforts of 
stakeholders at the local, state, and federal level to ensure an effective 
national disaster response system. The events surrounding Hurricane 
Katrina in August 2005 and the resulting lessons-learned and after-action 
reports by the Congress and administration prompted DHS to revise the 
just issued 2004 Plan. DHS released an interim revision of elements of the 
2004 Plan in May 2006 and developed a work plan for a more 
comprehensive revision in September 2006. Shortly thereafter, Congress 
passed the October 2006 Post-Katrina Act, which made the FEMA 
Administrator, through the National Integration Center, responsible for 
ongoing management and maintenance of the 2004 Plan, including 
periodic review and revision. In addition, the act required the DHS 
Secretary to establish a National Advisory Council of non-federal 
stakeholders to advise the FEMA Administrator in revising the 2004 Plan. 
During the summer of 2007 in the midst of the revision process, non- 
federal members of the emergency management community raised 
concerns over the extent to which DHS included them in the process. In 
September 2007, the House Committee on Transportation and 
Infrastructure held a hearing on DHS's management of the revision 
process and the involvement of non-federal stakeholders. DHS completed 
its revision efforts with the publication of the National Response 
Framework (NRF) on January 22, 2008. 3 The NRF is a guide for how the 
federal, state, local, and tribal governments, along with nongovernmental 
and private sector entities, will collectively respond to and recover from 
all disasters, particularly catastrophic disasters such as Hurricane Katrina, 
regardless of their cause. The NRF recognizes the need for collaboration 
among the myriad of entities and personnel involved in response efforts at 
all levels of government, nonprofit organizations, and the private sector. 
See figure 1 depicting the significant events and documents in the revision 
of the 2004 Plan into the 2008 NRF. 



The new National Response Framework became effective on March 22, 2008. 
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Figure 1 : Significant Events and Documents in DHS's Revision of the 2004 National Response Plan into the 2008 National 
Response Framework 
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Source: GAO analysis; DHS information. 

"See figure 5 for a time line on DHS's revision process from October 2006 to January 2008. 



In the explanatory statement accompanying the Consolidated 
Appropriations Act of 2008, the appropriations committees tasked GAO to 
review the process DHS used to update the NRF, including the process for 
including key stakeholders. We conducted our review to determine the 
extent to which (1) DHS collaborated with non-federal stakeholders in 
revising and updating the 2004 Plan into the 2008 NRF and (2) FEMA has 
developed policies and procedures for managing future revisions of the 
NRF, for which it is statutorily responsible. 

To address our objectives, we reviewed DHS and FEMA documents on the 
revision process and applicable statutes to determine the level to which 
the revision process was planned. To determine what happened during the 
process, we interviewed DHS and FEMA officials as well as non-federal 



Page 3 



GAO-08-768 FEMA's National Response Framework 



stakeholders representing state and local levels of government, emergency 
management associations, and others who served in key positions in the 
revision process, such as the co-leaders of work groups and members of a 
steering committee. The statements and views of these stakeholders are 
not generalizable to the population of non-federal stakeholders involved in 
the revision process. However, we selected these stakeholders because of 
their assigned key roles and believe that their views provided us with a 
general indication of stakeholder perspectives on their involvement in the 
revision process. To address our objectives, we reviewed DHS and FEMA 
documents on the revision process and applicable statutes to determine 
the level to which the revision process was planned. In assessing DHS and 
FEMA actions related to these objectives, we used criteria from our prior 
work on results-oriented government as well as best practices for federal 
coordination and collaboration with stakeholders. We also used criteria in 
GAO's Standards for Internal Control in the Federal Government* These 
standards, issued pursuant to the requirements of the Federal Managers' 
Financial Integrity Act of 1982 (FMFIA), provide the overall framework for 
establishing and maintaining internal control in the federal government. 
Also pursuant to FMFIA, the Office of Management and Budget issued 
Circular A-123, revised December 21, 2004, to provide the specific 
requirements for assessing and reporting on internal controls. Internal 
control standards and the definition of internal control in Circular A-123 
are based on GAO's Standards for Internal Control in the Federal 
Government. For more detailed information on our scope and 
methodology, see appendix I. 

We conducted this performance audit from September 2007 to June 2008, 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 



RGSllltS in Brief While DHS included non-federal stakeholders during the initial and final 

months of the process of revising the 2004 Plan, it did not collaborate with 
them as fully as envisioned in its original work plan or as required by the 



4 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 



(Washington, D.C.: November 1999). 



Page 4 



GAO-08-768 FEMA's National Response Framework 



2006 Post-Katrina Act. DHS's management of the initial stages of the 
revision process was generally consistent with the work plan and involved 
state and local stakeholders in identifying key issues and developing draft 
segments of the revised 2004 Plan. However, DHS deviated from its work 
plan and did not provide the first full revision draft to non-federal 
stakeholders for their comments and suggestions before conducting an 
internal, federal review of the draft because it required further 
modifications. Instead, DHS sent the first draft for the internal, federal 
review for 5 months before requesting stakeholder comment and without 
communicating the change in plans with the non-federal stakeholders. At 
the end of the 5-month internal review, DHS released a revised draft in 
September 2007, providing an opportunity for non-federal stakeholders as 
well as the general public to comment and have access to all non-federal 
comments submitted. DHS's approach was also not in accordance with the 
Post-Katrina Act's requirement that DHS establish a National Advisory 
Council (NAC) to incorporate non-federal input into the revision of 
national response doctrine. Although the NAC was to be established 
within 60 days of the Act (i.e., December 4, 2006), FEMA, which assumed 
responsibility for selecting members, did not name NAC members until 
June 2007 because of the additional time needed to review hundreds of 
applications and select a high quality body of advisors, according to the 
FEMA Administrator. The NAC's first meeting took place in October 2007 
after DHS issued the revised plan for public comment. 

While FEMA and the Congress, through the Post-Katrina Act, recognize 
the importance of partnering with non-federal stakeholders in disaster 
planning and response, FEMA has not yet developed guidance and 
procedures — elements specified as essential for planning and achieving 
effective results in Standards for Internal Control in the Federal 
Government — that describe how future revisions of the National 
Response Framework will be managed. The 2004 Plan included such 
guidance, including the circumstances that would lead to future 
revisions — such as changes in directives, laws, and lessons learned from 
exercises and actual events — and time frames for reviewing the plan. In 
addition, while these federal internal control standards state that 
communication with stakeholders is essential, FEMA has not articulated 
how it will involve stakeholders, or how the newly established NAC will be 
integrated into the revision process. Especially in view of a new 
administration, developing such policies and procedures is essential for 
ensuring that FEMA attains the Post-Katrina Act's goal of partnering with 
non-federal stakeholders in building the nation's emergency management 
system, including the periodic review and revision of the NRF. According 
to FEMA, it has not yet developed guidance and procedures because of the 
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need to focus federal resources on creating training materials to assist all 
stakeholders in implementing the current NRF in anticipation of the 
pending 2008 hurricane season. 

As FEMA begins to implement and review the 2008 NRF, we recommend 
that the Administrator develop and disseminate policies and procedures 
describing the conditions and time frames under which the next NRF 
revision will occur and how FEMA will conduct the next NRF revision. 
These policies and procedures should clearly describe how FEMA will 
integrate all stakeholders, including the NAC and other non-federal 
stakeholders, into the revision process and the methods for 
communicating to these stakeholders. 

We requested comments on a draft of this report from DHS and FEMA. 
They concurred with our recommendations and had no other comments. 



Background Several federal legislative provisions support preparation for and response 

° to disasters. The Robert T. Stafford Disaster Relief and Emergency 

Assistance Act 5 (Stafford Act) primarily establishes the programs and 
processes for the federal government to provide major disaster and 
emergency assistance to states, local governments, tribal nations, 
individuals, and qualified private nonprofit organizations. FEMA has 
responsibility for administering the provisions of the Stafford Act, and the 
Act provides the FEMA Administrator with the authority to prepare 
federal response plans and programs. In April 1992, FEMA issued a 
Federal Response Plan, which outlined how the federal government 
implements the Stafford Act. The Federal Response Plan described, 
among other things, the response and recovery responsibilities of each 
federal department and agency for saving lives and protecting public 
health and safety during an emergency or major disaster. 

After the events of September 11, 2001, and with the passage of the 
Homeland Security Act 6 in November 2002, FEMA became part of the 



6 42 U.S.C. 5121 et. seq. 

6 Pub. L. No. 107-296, 116 Stat. 2135 (2002). 
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newly formed Department of Homeland Security (DHS). 7 Under the Act, 
FEMA retained its authority to administer the provisions of the Stafford 
Act as well as its designation as the lead agency for the Federal Response 
Plan. The Homeland Security Act required DHS to consolidate existing 
federal government emergency response plans into a single, integrated, 
and coordinated national response plan. In December 2004, DHS issued 
the 2004 Plan to integrate the federal government's domestic prevention, 
preparedness, response, and recovery plans into one plan that addressed 
all disaster situations, whether due to nature, terrorism, or other man- 
made activities. The 2004 Plan incorporated or superceded other federal 
interagency plans such as the Federal Response Plan and the Federal 
Radiological Emergency Response Plan. 

In August 2005, Hurricane Katrina and, shortly after, hurricanes Wilma and 
Rita revealed a number of limitations in the 2004 Plan. Beginning in 
February 2006, reports by the House Select Bipartisan Committee to 
Investigate the Preparation for and Response to Hurricane Katrina, 8 the 
Senate Homeland Security and Governmental Affairs Committee, 9 the 
White House Homeland Security Council, 10 the DHS Inspector General, 11 
and DHS and FEMA 12 all identified a variety of failures and some strengths 
in the preparations for, response to, and initial recovery from Hurricane 
Katrina. After reviewing these reports, DHS concluded that the 2004 Plan 
required revision. In May 2006, DHS released immediate modifications to 
the 2004 Plan pending a more comprehensive review. In June 2006, 



' Our report will refer to individual DHS components such as FEMA where the component 
has a defined, specific authority or can be identified as being specifically responsible for a 
particular action or decision. Otherwise, any reference to DHS will refer to DHS as a whole 
unless clearly specified otherwise. 

8 U.S. House of Representatives, House Select Bipartisan Committee to Investigate the 
Preparation for and Response to Hurricane Katrina, A Failure of Initiative: Final Report 
of the House Select Bipartisan Committee to Investigate the Preparation for And 
Response to Hurricane Katrina (Washington, D.C.: Feb. 15, 2006). 

9 U.S. Senate Committee on Homeland Security and Governmental Affairs, Hurricane 
Katrina: A Nation Still Unprepared (Washington, D.C.: May 2006). 

10 White House Homeland Security Council, The Federal Response to Hurricane Katrina: 
Lessons Learned (Washington, D.C.: Feb. 23, 2006). 

11 Department of Homeland Security Office of Inspector General, A Performance Review of 
FEMA's Disaster Management Activities in Response to Hurricane Katrina, OIG-06-32 
(Washington, D.C.: Mar. 31, 2006). 

12 Federal Emergency Management Agency, DHS/FEMA Initial Response Hotwash: 
Hurricane Katrina in Louisiana, DR-1603-LA (Feb. 13, 2006). 
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Congress passed the Emergency Supplemental Appropriations Act for 
Defense, the Global War on Terror, and Hurricane Recovery, 2006. 13 In the 
conference report accompanying this act, the conferrees recommended 
that FEMA apply $3 million of its Preparedness, Mitigation, Response, and 
Recovery appropriation to immediately review and revise the 2004 Plan as 
well as its companion document, the National Incident Management 
System, which provides standard command and management structures 
that apply to response activities. 14 

On October 4, 2006, the Post-Katrina Act was enacted. This act, among 
other things, made certain organizational changes within DHS to 
consolidate emergency preparedness and emergency response functions 
within FEMA, required that DHS maintain FEMA as a distinct entity within 
the department, and designated the FEMA Administrator — the new title of 
the official who will lead the agency — as the principal advisor to the 
President, the Homeland Security Council, and the Secretary for all 
matters relating to emergency management. Most of the organizational 
changes, such as the transfer of various functions from DHS's Directorate 
of Preparedness to FEMA, became effective as of March 31, 2007. Others, 
such as the increase in the organizational autonomy for FEMA and the 
establishment of the National Integration Center, became effective upon 
enactment. The Post-Katrina Act specified that the FEMA Administrator, 
acting through the Center, "shall ensure ongoing management and 
maintenance of the. . .National Response Plan," including periodic review 
and revision. The Post-Katrina Act also directed the Secretary to establish 
a National Advisory Council (NAC) by December 2006 to, among other 
things, incorporate state, local, and tribal government and private sector 
input in the development and revision of the 2004 Plan. As established by 
the Post-Katrina Act, the NAC is intended to be an ongoing advisory 
council that draws upon individuals with a broad body of expertise and 
geographic and substantive diversity. The Act requires the NAC to advise 
the Administrator on a variety of emergency management issues across 
the national preparedness spectrum, including the 2004 Plan. 

In January 2008, DHS issued the 2008 NRF, the product of the revision of 
the 2004 Plan. The NRF became effective in March 2008 and retained the 
basic structure of the 2004 Plan. For example, like the 2004 Plan, the 
NRF's core document describes the doctrine that guides national response 



" Pub. L. No. 109-234, 120 Stat. 418 (2006). 
14 H.R. Conf. Rep. No. 109-494, at 118 (2006). 
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actions and the roles and responsibilities of officials and entities involved 
in response efforts. Further, the NRF also includes Emergency Support 
and Incident Annexes. However, in contrast to the 2004 Plan, FEMA plans 
to include four partner guides to the NRF that describe key roles and 
actions for local, tribal, state, federal and private sector entities involved in 
response activities. 



DHS Did Not 
Collaborate with Non- 
Federal Stakeholders 
As Fully As Planned 
or Required in 
Developing the NRF 



While DHS included non-federal stakeholders at the initial and final stages 
in the process of revising the December 2004 Plan, it did not collaborate 
with them as fully as planned in its revision work plan or as required by 
the Post-Katrina Act. DHS based the work plan, which was approved by a 
White House Homeland Security Council-chaired policy committee, on a 
section in the 2004 Plan that provided procedural guidance for managing 
revisions of the document. DHS managed the initial stages of the revision 
process according to the work plan. However, DHS deviated from its work 
plan after the first draft was completed in April 2007. Instead of widely 
disseminating the first draft to all stakeholders, including non-federal 
stakeholders, for comment and modification, DHS retained the draft to 
make modifications that it felt were necessary and conducted an internal, 
federal review of the draft for a 5-month period. DHS delayed the release 
of the April 2007 draft and provided limited communication to state and 
local stakeholders on the status of the review until after releasing the draft 
for public comment in September 2007. In addition, DHS did not manage 
the revision process in accordance with the Post-Katrina Act's provision 
that DHS establish FEMA's NAC by December 2006 and incorporate the 
NAC's non-federal input into the revision. 
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DHS Created a Work Plan 
to Revise the 2004 
National Response Plan, 
Specifying Revision Issues, 
Entities and Tasks, and a 
Time Line for Completing 
the Revision 



Hurricane Katrina hit the Gulf Coast in August 2005 and the nation's 
response prompted DHS to revise the 2004 Plan. In May 2006, DHS issued 
an official Notice of Change 1 * to the 2004 Plan to incorporate lessons 
learned from the response to hurricanes Katrina, Wilma, and Rita as well 
as to incorporate organizational changes within DHS. This Notice of 
Change — which was distributed to all signatories 16 of the 2004 Plan, DHS 
headquarters and regional offices, and state emergency management and 
homeland security offices — noted that DHS intended to initiate a 
comprehensive stakeholder review of the 2004 Plan in the fall of 2006. 
Accordingly, DHS developed a work plan to manage the revision of the 
2004 Plan that established (1) the issues that were to be the focus of the 
revision process, (2) the entities to be created to implement the process 
and the tasks involved, and (3) a timeline for completing the revision 
process and issuing the final document. DHS based its work plan for 
revising the 2004 Plan on guidance found in the Plan itself. Anticipating 
that modifications or updates would arise when needed, the 2004 Plan 
included a section specifying how DHS would conduct interim changes 
and full revisions, listing the time frames and circumstances — within the 
first year and every 4 years, or more frequently if the Secretary deems 
necessary, to incorporate new presidential directives, legislative changes, 
and procedural changes based on lessons learned from exercises and 
actual events. The Domestic Readiness Group, an interagency group that 
coordinates preparedness and response policy and is chaired by staff of 
the White House Homeland Security Council, approved DHS's work plan 
in September 2006. For the revision process, the Domestic Readiness 
Group was to provide strategic policy coordination, be a mechanism for 
vetting the revision at the federal level, and was to resolve conflicting 
policy issues. 



° According to the December 2004 National Response Plan, a Notice of Change for 
updates to the Plan must specify the date, number, subject, purpose, background, and 
action required and provide the change language on one or more numbered and dated 
insert pages that would replace the modified pages in the Plan. Once published, the 
modifications were to be considered part of the Plan for operational purposes pending a 
formal revision and reissuance of the entire document. 

16 There were 32 signatories to the 2004 National Response Plan — the heads of 15 federal 
departments, plus the Central Intelligence Agency, Environmental Protection Agency, FBI, 
Federal Communications Commission, General Services Administration, NASA, National 
Transportation Safety Board, Nuclear Regulatory Commission, Office of Personnel 
Management, Small Business Administration, Social Security Administration, Tennessee 
Valley Authority, U.S. Agency for International Development, U.S. Postal Service, American 
Red Cross, Corporation for National and Community Service, and National Voluntary 
Organizations Active in Disaster. 
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The work plan contained an initial list of 14 revision issues. According to 
FEMA officials, they compiled these issues by reviewing Hurricane Katrina 
after-action and lessons-learned reports from the White House, Congress, 
GAO, and the DHS Inspector General and identifying common issues that 
were raised in multiple reports. According to the work plan, DHS was to 
conduct meetings with selected stakeholders to review the initial list and 
identify other issues to be considered during the revision process. The 
result of these meetings was to be a finalized list of revision issues that 
would serve as the starting point for revising the 2004 Plan. 

Based on the 2004 Plan, DHS created three entities to facilitate the 
revision process: the Steering Committee, the Writing Team, and 12 Work 
Groups. 17 DHS provided a copy of the approved work plan to all 
participants. The Steering Committee was to conduct the day-to-day 
management and oversight of the 2004 Plan revision process, which 
included managing the Work Groups and overseeing the Writing Team. 
The work plan assigned overall management of the 2004 Plan rewrite to 
the Writing Team, which was to assign issues to the Work Groups and 
track the Work Groups' progress on resolving the assigned issues. The 
Work Groups, which were chaired by designated co-leaders, were to 
examine the issues received from the Writing Team and determine if 
existing language in the 2004 Plan adequately addressed the issues. If the 
Work Groups determined that current language in the 2004 Plan did not 
adequately address the issue, they were required to provide 
recommendations to the Writing Team on how the issues should be 
addressed. Figure 2 shows the relationship between the entities involved 
in the revision process. 



The work plan also established a fourth entity, the Interagency Task Force. The work 
plan primarily charged the Task Force with resolving conflicts in preparedness and 
response policy before these conflicts were presented to the Domestic Readiness Group 
for resolution. 
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Figure 2: Relationship among Entities within the September 2006 Revision Work Plan 



Secretary of Homeland Security 

Overall responsibility for 2004 Plan Revision 

• FEMA Administrator 3 • Undersecretary for Preparedness 15 

• National Integration Center 



Homeland Security Council Chaired 
Domestic Readiness Group 

Provide strategic policy coordination 

Mechanism for vetting the revision at the federal level 

Resolve conflicting policy issues 



Steering Committee 

• Day-to-day management and oversight of the revision process 

• Management of the Work Groups and oversight of the Writing Team 



Writing Team 

Overall management of the rewrite 

Assigned and tracked writing issues to Work Groups 



Work Groups 

Examined writing issues to determine if existing language in 
document was adequate 

If existing language deemed inadequate, provided recommended 
changes to Writing Team 



Source: GAO analysis of DHS data. 

"The work plan referred to the FEMA Administrator by his former title, which was the Under Secretary 
for Federal Emergency Management. 

"Most of the DHS preparedness functions became part of FEMA as part of the Post-Katrina Act, and 
the transfer of these responsibilities became effective on March 31 , 2007. 



The revision schedule in the work plan was to begin in December 2006 
with a goal to complete the revision process by June 2007. As a first step in 
the plan, the Writing Team was to provide the Work Groups with writing 
assignments. Once the Work Groups completed their writing assignments, 
the Writing Team was to review their recommendations and submit a draft 
of the revised NRF to the Steering Committee for its review and approval. 
The Steering Committee was to release the first draft of the revised NRF 
for stakeholder comment by the end of January 2007 with an approximate 
30-day review period. According to the work plan, the Steering Committee, 
Writing Team, and Work Groups would review comments on this first 
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draft, make any needed modifications, and release a second draft at the 
end of March 2007 for the final of two 30-day comment periods. Per the 
work plan, these two comment periods would ensure wide dissemination 
of the product to all stakeholders, including federal agencies, state and 
local governments, and major professional associations. The work plan 
schedule also included a 2-month internal, federal review process to take 
place beginning in May 2007, after which DHS would provide the final 
draft for approval to the Domestic Readiness Group and the signatories of 
the 2004 Plan, with the final issuance of the revised 2004 Plan targeted for 
June 2007. See figure 3 for the proposed timeline for the revision process. 



Figure 3: DHS's Revision Process as Planned by Its September 2006 Work Plan and as Required by the October 2006 Post- 
Katrina Act 



Sept. Oct. Nov. Dec. Jan. Feb. Mar. Apr. May June July Aug. Sept. Oct. Nov. Dec. Jan. 



Approved 
revision 
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Release 
first draft to 
stikeholders 

I 



Release 
second draft to 
stakeholders 



Publish 
revised plan 



Conduct internal 
federal review 



2007 



2008 



Source: GAO analysis of DHS data, and the Post-Katrina Act. 



DHS Included Non-Federal 
Stakeholders at the 
Beginning of the Revision 
Process 



DHS included non-federal stakeholders in the early stages of the 2004 Plan 
revision process in accordance with the work plan. For example, in 
October 2006, DHS hosted a meeting with approximately 90 non-federal 
stakeholders where DHS sought feedback on the 14 revision issues from 
participants using structured breakout groups. At this meeting, FEMA 
reported that non-federal stakeholders identified the need for 
enhancements to the 2004 Plan to further describe coordination processes 
with the private sector and volunteer organizations. DHS held a similar 
meeting with federal stakeholders in November 2006. According to DHS, it 
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modified the scope of some of the 14 revision issues and added three 
additional issues. (See app. II for a listing of the 17 revision issues.) 

DHS assigned non-federal stakeholders to serve as members of the 
Steering Committee and the Work Groups. Although the work plan called 
for the engagement of all levels of stakeholders in the revision process and 
described the Steering Committee and Work Groups, it did not specify the 
composition of the Work Groups but stated that one non-federal 
stakeholder would serve on the Steering Committee. In the spirit of the 
plan, DHS selected non-federal officials to serve on the Steering 
Committee and Work Groups. Of the 32 members on the Steering 
Committee, six members or 19 percent were non-federal officials, 
including representatives from state and local government emergency 
management associations as well as a local fire department and police 
associations. According to a FEMA official, the Steering Committee, led by 
FEMA and DHS co-chairs, generally met on a weekly basis via 
teleconferences throughout the revision process. 

Of the approximately 710 members who served on the 12 Work Groups, 
224 officials, or 32 percent, were non-federal officials, including 3 of the 27 
Work Group co-leaders. 18 These non-federal officials included 
representatives from state and local emergency management agencies and 
tribal governments as well as officials from the fire, law enforcement, and 
public health sector. See figure 4 for the composition of the 12 Work 
Groups members by level of government, nongovernmental organization, 
and private sector. See appendix III for a listing of the 12 Work Groups and 
a table showing the occupational demographics of the non-federal 
stakeholders who served on the Work Group. 



Some Work Groups had one leader and others had two or three co-leaders. 
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Figure 4: Composition of the 710 Members of the 12 Work Groups by Federal, State, 
Local, and Tribal Government, Nongovernmental Organization, and Private Sector 



Tribal government - 9 members 




Private sector - 34 members 
Local government - 35 members 

State government - 67 members 

Nongovernmental organization 
- 79 members 



' Federal government - approximately 486 

members 

Source: GAO analysis of DHS data. 

Note: There was some uncertainty in the exact total number of Work Group members due to 
duplication and lack of identifying information in the data FEMA provided. However, because the 
inclusion of non-federal stakeholders is the focus of this report, we took steps to correctly determine 
the total number and composition of the non-federal Work Group members. 



The Writing Team, which consisted of 11 federal officials and private 
contractors for administrative support, did not include any non-federal 
stakeholders. DHS stated that they invited one non-federal stakeholder to 
be on the team but that they were not successful in their attempts to 
secure that person. 

The 12 Work Groups met in January and February 2007. During that time, 
and in accordance with the work plan, the Work Groups met to address 
the issues assigned to them by the Writing Team. Most Work Groups 
addressed their issues by submitting recommended language changes to 
the 2004 Plan, which generally consisted of inserting new language or 
clarifying existing language. The Work Groups supported a recommended 
language change by providing the rationale for such a change. For 
example, the Writing Team tasked the Roles and Responsibilities Work 
Group with clarifying and strengthening the role of state governments in 
the 2004 Plan. One recommended language change suggested by this Work 
Group was to describe the state government's role in the coordination of 
resources through the Emergency Management Assistance Compact, an 
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interstate mutual aid compact that provides a legal structure through 
which affected states may request assistance from other states during a 
disaster. 19 

All Work Group recommendations were due to the Writing Team by the 
middle of February 2007. Although the work plan provided for the Work 
Groups' continued involvement after submitting their recommendations, 
this did not occur. 

DHS Departed from the Work 
Plan by Conducting an Internal 
Federal Review Rather Than 
Providing a Draft to Non- 
Federal Stakeholders for 
Comment 

According to FEMA officials, the first draft of the revised 2004 Plan was 
completed in April 2007 and incorporated many of the Work Groups' 
recommendations. However, rather than sending this first draft to 
stakeholders for comment, DHS conducted its internal, federal review of 
the draft document for approximately 5 months until September 2007. 
FEMA officials said that DHS did not release this April 2007 draft for 
comment because the draft required further modifications DHS considered 
necessary. An April 11, 2007, notice subsequently posted on DHS's Web 
site described the status of the process and its plans to further revise the 
draft for comment. 

"As the NRP revision process unfolded, it became apparent that some important issues 
were more complex than we originally thought and require national-level policy decisions. 
We also came to the realization that creating a more user-friendly document that clearly 
addressed the roles and responsibilities of stakeholders and incident management 
structures would require substantial format changes to the NRP. . . An updated timeline has 
not been determined but we will share one with you quickly." 

FEMA officials said that the length of time for the review and approval 
process, about 3 months longer than planned, was unpredictable and that 
it took longer than they had expected. DHS did not modify or update the 



On March 13, 2007, DHS officials e-mailed stakeholders that the release of 
the first revision draft for the first 30-day comment period was being 
delayed. According to the message, DHS still planned to release the draft 
within the next several weeks and issue a final document by June 1, 2007. 
The message noted that once an updated timeline was approved, DHS 
would share the dates with the stakeholders. 



GAO reported on this state-level compact in GAO, Emergency Management Assistance 
Compact: Enhancing EMAC's Collaborative and Administrative Capacity Should 
Improve National Disaster Response, GAO-07-854 (Washington, D.C.: June 29, 2007). 
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work plan to reflect this deviation from the approved revision process or 
propose how the revision process would now be completed. 

Certain non-federal stakeholders we interviewed who served on the 
Steering Committee and as co-leaders on the Work Groups reported 
receiving occasional or no communication from DHS on the decision not 
to release the first draft for comment or how the revision process would 
be completed during this internal, federal review process. FEMA's Deputy 
Administrator acknowledged that the federal government should have 
done a better job in communicating the status of the draft and the revision 
process to non-federal stakeholders while the document was undergoing 
the internal, federal review. 

During this internal, federal review, DHS and FEMA officials continued to 
revise the April 2007 draft. For example, FEMA officials said that they 
added a chapter to explain the need for all levels of government to plan for 
preparedness and response actions and additional language to clarify the 
role of state and local governments during disaster response. At this point 
in the process, around August 2007, DHS's Office of the Deputy Secretary 20 
decided to release a revised draft just to the Steering Committee and the 
Domestic Readiness Group for comment. Writing Team officials assumed 
that the Deputy Secretary would make the final decision on whether to 
incorporate the comments received while staff from his office would be 
responsible for completing any further edits. A draft of this document, 
dated July 2007, was leaked to the press in August 2007. 

During a September 11, 2007, hearing before the House Transportation and 
Infrastructure Committee, 21 officials representing state and local 
emergency management associations expressed their concerns that the 
July 2007 leaked draft had changed significantly from the April 2007 draft. 
The government affairs committee chair of the International Association 



The DHS Deputy Secretary at the time resigned from his position in October 2007. 

21 Readiness in the Post-Katrina and Post-9/11 World, Hearing of U.S. House 
Representatives, Committee on Transportation and Infrastructure, Subcommittee on 
Economic Development, Public Buildings, and Emergency Management, Sept. 11, 2007. The 
purpose of this hearing was to explore the process for revising the 2004 National Response 
Plan. 
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of Emergency Managers 22 testified, "The document we saw bore no 
resemblance to what we had discussed so extensively with FEMA and 
other stakeholders in the December 2006 through February 2007 timeline." 
Additionally, the National Emergency Management Association 23 
representative, who served on the Steering Committee, expressed his 
concern that its association had been effectively shut out of the process, 
testifying that the collaborative process in rewriting the 2004 Plan "broke 
down... with no stakeholder input, working group involvement, or steering 
committee visibility." 

After the Internal, Federal After the approximate 5-month internal, federal review period, DHS 

Review, DHS Provided All released a draft of the newly renamed National Response Framework for 

Stakeholders an Opportunity to public comment on September 10, 2007. However, as we stated earlier, the 
Comment before Final original work plan called for DHS to provide stakeholders with two 30-day 

Publication and Considered All public comment periods before the internal, federal review; after the 
Comments in Finalizing the review, DHS was to publish the revised document without further 

New Framework comment by stakeholders. The public comment period starting on 

September 10 allowed for both federal and non-federal stakeholders to 
provide their reactions to the changes made during the internal federal 
review process. FEMA officials said they conducted this unplanned public 
comment period to address the work plan's requirement that the draft 
NRF be widely disseminated for all stakeholders to review. FEMA 
provided a 40-day public comment period for the NRF core document. 
FEMA received 3,318 comments on the core NRF. 24 

The Writing Team led the adjudication — review, analysis, and resolution — 
of the comments received during the public comment period. The Writing 



The International Association of Emergency Managers is a non-profit educational 
organization of emergency managers and disaster response professionals from all levels of 
government, as well as the military, the private sector and volunteer organizations in 58 
countries, with the mission to serve its members by providing information, networking and 
professional opportunities, and to advance the emergency management profession. 

23 The National Emergency Management Association is a nonprofit, nonpartisan association 
of emergency management and homeland security professionals with a mission to provide 
national leadership and expertise in comprehensive emergency management; serve as a 
vital emergency management information and assistance resource; and advance 
continuous improvement in emergency management through strategic partnerships, 
innovative programs, and collaborative policy positions. 

24 FEMA also released NRF's supplemental materials — including the Emergency Support 
Function Annexes, the Support Annexes, and the Incident Annexes — for a 30-day public 
comment period and received 2,385 comments on these documents. See appendix II for 
descriptions of these NRF supplemental materials. 
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Team examined each comment, made an initial disposition 
recommendation — accepted, modified, rejected, or noted — and forwarded 
that recommendation to the FEMA leadership and the Domestic Readiness 
Group for review. In addition, FEMA posted a spreadsheet on 
www.regulations.gov that included, among other things, the comments 
made by non-federal stakeholders and the final disposition FEMA assigned 
to each of those comments. This allowed these stakeholders to see how 
FEMA did or did not incorporate their comments into the final NRF 
document. The Work Groups and Steering Committee, both of which 
contained non-federal stakeholders, were not involved in adjudicating the 
public comments, although this was called for by the work plan. A FEMA 
official said that the agency tried to recruit a non-federal stakeholder to 
serve on the Writing Team, but that its efforts were unsuccessful. 



DHS's Establishment of the 
National Advisory Council 
Did Not Meet Post-Katrina 
Act Deadlines, Which Also 
Limited Collaboration with 
Non-Federal Stakeholders 



The Post-Katrina Act required the DHS Secretary to establish a National 
Advisory Council (NAC) by December 2006 to advise the FEMA 
Administrator on all aspects of emergency management. Among its 
specific responsibilities, the NAC was to incorporate input from state, 
local, and tribal governments as well as the private sector in the revision of 
the 2004 Plan. The Act stated that the membership of the NAC should 
represent a geographic and substantive cross-section of officials, 
emergency managers, and emergency response providers, such as law 
enforcement, fire service, health scientists, and elected officials. However, 
DHS did not incorporate the NAC by amending its approved September 
2006 work plan for revising the 2004 Plan or establish the NAC in time for 
the Council to incorporate non-federal stakeholder input into the revision 
of the 2004 Plan, as directed by the October 2006 Post-Katrina Act. 
According to a FEMA official, DHS did not amend the work plan to 
incorporate the NAC because of the uncertainty surrounding the time it 
would take to establish the NAC. The official said FEMA expected that 
establishing the NAC would take more time than the Post-Katrina Act 
allowed because FEMA wanted to ensure that the NAC's membership 
complied with the requirements contained in the Post-Katrina Act while 
also providing adequate time to announce the NAC's creation, solicit 
applications for membership, and review and select applicants for 
membership. FEMA announced the membership of the NAC in June 2007, 
6 months after the Post-Katrina Act deadline, and the NAC did not hold its 
inaugural meeting until October 22, 2007, the last day of the public 
comment period for the base NRF. According to the FEMA Administrator, 
it was more important for the agency to invest the time needed to review 
hundreds of applications and create a high quality body of advisors than to 
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rush the process to meet the 60-day statutory deadline for establishing the 
NAC. 



As a result, the NAC's only involvement in the NRF revision process 
occurred when FEMA provided it with a copy of a draft in December 2007, 
2 months after the public comment period closed. According to the NAC 
chairman, the NAC gathered and consolidated comments from individual 
members and provided these comments to the FEMA Administrator 
approximately one month before FEMA published the NRF in January 
2008. 25 The chairman noted that these comments were from individual 
members and did not reflect the official comments of the NAC as a whole. 
For the next NRF revision, the chairman stated that he expected the NAC 
to be actively involved with FEMA throughout the entire revision process. 
For example, he suggested that the NAC could have a role in the 
adjudication of public comments by representing non-federal stakeholders 
during the adjudication process to ensure FEMA is aware of issues that are 
critically important to state and local governments. The NAC is currently 
exploring its role in reviewing and implementing the 2008 NRF. For 
example, at the NAC's February 2008 meeting the NAC Chairman 
approved a standing committee on the NRF that may focus on actions that 
can help FEMA implement and train stakeholders on the NRF. While the 
NAC filed a charter on February 6, 2007, the charter reflects the NAC's 
broad array of statutory responsibilities, but does not detail any specific 
responsibilities the NAC would undertake relative to the NRF revision 
process. See figure 5 for a comparison of DHS's actual revision process 
with its proposed process. 



° NAC submitted comments by using the form that FEMA asked the public to use when 
submitting comments on www.regulations.gov. 
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Figure 5: DHS's Actual Revision Process Compared with Its Proposed Process 
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DHS'S REVISION PROCESS BY WORK PLAN AND POST-KATRINA ACT 




Source: GAO analysis of DHS data, and the Post-Katrina Act. 



The late establishment of the NAC also hindered FEMA from fully 
collaborating with non-federal stakeholders who were involved in the 
revision process established by the approved work plan. In particular, two 
non-federal Steering Committee members stated that after the August 2007 
leak of the draft NRF, FEMA stopped sharing drafts with non-federal 
officials. FEMA officials said that the reason for this decision was because 
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FEMA had yet to establish the NAC, its official advisory committee. FEMA 
officials said that the absence of an official advisory committee raised 
fairness concerns about which members of the non-federal community 
should be allowed to provide input before the public comment period. As a 
result, FEMA stopped sharing pre-decisional drafts with non-federal 
members of the Steering Committee because FEMA did not plan to 
provide the same opportunity to other non-federal stakeholders until the 
public comment period. 



FEMA and the Post- 
Katrina Act Have 
Recognized the 
Importance of 
Including Non-Federal 
Stakeholders in 
Developing National 
Response Doctrine, 
but FEMA Lacks 
Guidance and 
Procedures for Future 
NRF Revisions 



While FEMA has recognized the importance of partnering with non-federal 
stakeholders to achieve the nation's emergency management goals, both in 
congressional testimonies as well as in its January 2008 strategic plan, 
FEMA has not yet developed guidance and procedures for how future 
revisions of the NRF will be managed or how the newly established 
National Advisory Council will be integrated into the revision process in 
accordance with the Post-Katrina Act. Standards for Internal Control in 
the Federal Government state that management guidance, policies, and 
procedures are an integral part of any agency's planning for, and 
achieving, effective results. 26 Developing such policies and procedures for 
how the NRF will be revised in the future and how FEMA will integrate the 
NAC and other non-federal stakeholders in the process is essential for 
helping to ensure that FEMA attains its goal of partnering with nonfederal 
stakeholders to help achieve the nation's emergency management goals. 



GAO, GAO/AIMD-00-21.3.1. 



Page 22 



GAO-08-768 FEMA's National Response Framework 



FEMA and the Post- 
Katrina Act Stress 
Partnership and 
Communication with Non- 
Federal Stakeholders in 
Achieving the Nation's 
Emergency Management 
Goals 



FEMA has recognized the importance of including the input of non-federal 
stakeholders to help achieve the nation's emergency management goals. 
For example, in November 2006, the FEMA Administrator outlined his 
vision for a "New FEMA," 27 asserting FEMA's dedication to partnering with 
all states and the private sector because of FEMA's reliance on its partners 
to accomplish the national emergency response objectives. More recently, 
in congressional testimonies the FEMA Administrator has reaffirmed the 
need for FEMA to partner with both federal and non-federal 
stakeholders. 28 In addition, one objective in FEMA's Strategic Plan for 
2008-2013 is to engage public and private stakeholders in developing and 
communicating clear national doctrine and policy. 29 To achieve this 
objective, the Strategic Plan identifies the need to engage stakeholders 
early and often in the process of developing national doctrine. This is in 
accordance with internal control standards for the federal government 
that state that information should be communicated to those who need it 
and in a form and within a time frame that enables them to carry out their 
responsibility for an agency to achieve its objectives. 30 For example, 
management should ensure there are adequate means of communicating 
with and obtaining information from external stakeholders who may have 
a significant impact on the agency's achieving its goals. In October 2005, 
we also reported that frequent communication among collaborating 
organizations and stakeholders is a means to facilitate working across 
boundaries, prevent misunderstanding, and achieve agency objectives. 31 
Frequent communication is one of a number of practices that enhance and 
sustain collaboration. 



Federal Emergency Management Agency, Director Paulison Lays Out Vision for "New 
FEMA, " Press Release FNF-06-019 (November 2006). 

28 "Reforming FEMA: Are We Making Progress?" R. David Paulison statement for the record 
before the United States House of Representatives, House Homeland Security Committee, 
Subcommittee on Emergency Communications, Preparedness, and Response and 
Subcommittee on Management, Investigations, and Oversight, February 28, 2007; and "The 
2007 Hurricane Season: Are We Prepared?" R. David Paulison Oral Statement Before the 
United States House of Representatives, House Homeland Security Committee, 
Subcommittee on Emergency Communications, Preparedness, and Response, May 15, 2007. 

29 Federal Emergency Management Agency, FEMA Strategic Plan Fiscal Years 2008-2013: 
The Nation's Preeminent Emergency Management and Preparedness Agency, FEMA P- 
422 (January 2008). 

30 GAO, GAO/AIMD-00-21.3.1. 

31 GAO, Results-Oriented Government: Practices That Can Help Enhance and Sustain 
Collaboration among Federal Agencies, GAO-06-15 (Washington, D.C.: October 2005). 
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Recognizing the importance of collaboration, the Post-Katrina Act requires 
that the FEMA Administrator partner with non-federal stakeholders from 
state, local, and tribal governments, the private sector, and 
nongovernmental organizations to build a national system of emergency 
management that can effectively and efficiently utilize the full measure of 
the nation's resources to respond to all disasters, including catastrophic 
incidents, and acts of terrorism. 32 Specifically, the Post-Katrina Act directs 
the FEMA Administrator, through the National Integration Center, to 
periodically review and revise the National Response Plan and any 
successor to such plan and, as discussed above, to establish the NAC to 
incorporate non-federal stakeholder input in the revision and development 
of the Plan, among other things. The Post-Katrina Act further directs the 
FEMA Administrator to appoint council members who represent a 
geographic and substantive cross section of officials, emergency 
managers, and emergency response providers from the non-federal 
community. 

The FEMA Administrator's statements, the agency's latest strategic plan, 
and the Post-Katrina Act also reflect a key precept related to government 
performance and results — that stakeholders can have a significant effect 
in determining whether a federal agency's program or action will succeed 
or fail, and as such, stakeholders need to be involved in major planning 
efforts conducted by the agency. 33 Such involvement is important to help 
agencies ensure that their efforts and resources are targeted at the highest 
priorities and is particularly important in instances where federal agencies 
face a complex political environment, such as emergency management in 
which FEMA's successes depend on the actions of non-federal partners at 
the state and local levels. 



s - The Post-Katrina Act, Pub. L. No. 109-295, § 611, 120 Stat. 1355, 1396-1397 (amending the 
Homeland Security Act, § 503(b)(2)(B). 

33 GAO, Executive Guide: Implementing the Government Performance and Results Act, 
GAO/GGD-96-1 18 (Washington, D.C.: June 1996). 



Page 24 



GAO-08-768 FEMA's National Response Framework 



FEMA Has Not Yet 
Developed Guidance and 
Procedures for Managing 
Future Revisions or 
Integrating the National 
Advisory Council into the 
Revision Process 



While FEMA officials and the National Response Framework 
acknowledge that the NRF will need to be revised in the future, FEMA has 
not developed guidance or policies on how it will manage future revisions 
or described how the NAC will be incorporated into the next NRF revision 
process. FEMA officials said that the agency has not yet developed 
guidance and procedures for any future NRF revisions because of the need 
to focus federal resources on creating training materials to assist all 
stakeholders in implementing the current NRF in anticipation of the 
pending 2008 hurricane season. As mentioned earlier in this report, the 
2004 Plan included a section specifying the circumstances, such as lessons 
learned from exercises and actual events, and time frames under which it 
would need to be reviewed and revised. This section is in accordance with 
the federal internal control standard of monitoring operations to assess 
the quality of performance over time and ensure that the findings of 
reviews and evaluations are resolved. The 2008 NRF, while it states that it 
merits periodic review and revision, does not contain such language 
regarding the circumstances and time frames for its review and revision. In 
addition, FEMA officials said that the process established for the last 
revision (the 2006-approved work plan) would not be applicable for any 
future revisions because it did not consider the role of the NAC. The NAC 
has also not yet determined how it would like to be involved in the next 
NRF revision process. The NAC's charter, approved in February 2007, does 
not provide specific procedures on how it is to be involved and, according 
to the chairman, the NAC's NRF subcommittee expects to focus its efforts 
on helping FEMA train non-federal stakeholders. 

Having such guidance and procedures in place is an important internal 
control, and we have identified this need for other agencies in similar 
circumstances to FEMA's management of future NRF revisions. As we 
discussed earlier in this report, control activities — such as guidance, 
policies, and procedures — are an integral part of an agency's planning for 
and achieving effective results. 34 In addition, while internal controls should 
be flexible to meet an agency's needs, they should also be clearly 
documented, readily available, and properly maintained. We have also 
previously reported on the need to include state and local jurisdictions in 
the development of national response plans because they are key 
stakeholders and would be on the front lines if an incident occurs. 



GAO, GAO/AIMD-00-21.3.1. 
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• In April 2008, we reported on the need for the Department of Defense's 
Northern Command to collaborate and communicate with non-federal 
stakeholders and establish a process to guide such collaboration in 
accessing information on state emergency response plans and capabilities, 
noting that the absence of effective collaboration could impede 
intergovernmental planning for catastrophic incidents and overall 
coordination. 35 Specifically, we reported that federal officials involved the 
states only minimally in the development of the Department of Defense's 
major homeland defense and civil support plans and that defense officials 
were generally not familiar with state emergency response plans and 
capabilities and had not established a process for gaining access to this 
information. We also reported that each agency's roles and responsibilities 
for planning for homeland defense and civil support during a catastrophic 
disaster were not clearly defined. We recommended, among other things, 
that the Department of Defense develop a thorough process to guide its 
coordination with the states. The department generally agreed with the 
recommendation and stated that it was coordinating with DHS to develop 
synchronized plans of integrated federal, state, and local operational 
capabilities to affect a coordinated national response. It is essential for 
both the Department of Defense and DHS to have such guidance in place, 
as both DHS's National Response Framework and the Northern 
Command's Concept of Operations emphasize coordination with non- 
federal stakeholders in order to prevent, prepare for, respond to, and 
recover from catastrophic natural and manmade disasters. 

• In August 2007, we reported on the administration's approach to preparing 
for a pandemic influenza by issuing, among other things, a National 
Strategy for Pandemic Influenza (Strategy) in November 2005, and a 
National Strategy for Pandemic Influenza Implementation Plan (Plan) 
in May 2006. 36 We reported, among other things, that state and local 
jurisdictions were not directly involved in developing the Strategy and 
Plan. Neither the Strategy nor Plan described the involvement of key 
stakeholders, such as state, local, and tribal entities, in their development, 
even though these stakeholders would be on the front lines in a pandemic 
and the Plan identifies actions they should complete. Officials told us that 



J GAO, Homeland Defense: Steps Have Been Taken to Improve U.S. Northern Command's 
Coordination with States and National Guard Bureau, but Gaps Remain, GAO-08-252 
(Washington, D.C.: Apr. 16, 2008). 

36 GAO, Influenza Pandemic: Further Efforts are Needed to Ensure Clearer Federal 
Leadership Roles and Effective National Strategy, GAO-07-781 (Washington, D.C.: Aug. 14, 
2007). See also GAO, Influenza Pandemic: Opportunities Exist to Clarify Federal 
Leadership Roles and Responsibilities and Improve Pandemic Planning, GAO-07-1257T 
(Washington, D.C.: Sept. 26, 2007). 
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while the drafters of the Plan were generally aware of their concerns, 
state, local, and tribal entities were not directly involved in reviewing and 
commenting on the Plan. We concluded that opportunities existed to 
improve the usefulness of the Plan because it was viewed as an evolving 
document and was intended to be updated on a regular basis to reflect 
ongoing policy decisions as well as improvements in domestic 
preparedness. However, time frames or mechanisms for updating the Plan 
were undefined. We recommended that the White House Homeland 
Security Council establish a specific process and time frame for updating 
the Plan and that the update process should involve key non-federal 
stakeholders and incorporate lessons learned from exercises and other 
sources, but the Homeland Security Council did not provide comments on 
this recommendation. 

Without similar policies and procedures documenting the circumstances 
and time frames under which it would review and revise the NRF and its 
process for collaborating with non-federal stakeholders, FEMA cannot 
ensure that future revision processes will be conducted in accordance 
with management's directives. 



Conclusions ^ disasters occur locally, and the initial post-disaster response is local. 

However, large-scale disasters usually exceed local response capabilities. 
Effective preparation and response for major and catastrophic disasters 
require well-planned and well-coordinated actions among all those who 
would have a role in the response to such disasters. The 2008 NRF is a 
guide for the myriad of entities and personnel involved in response efforts 
at all levels. The NRF recognizes the need for collaboration among these 
stakeholders to collectively respond to and recover from all disasters, 
particularly catastrophic disasters such as Hurricane Katrina, regardless of 
their cause. 



To help ensure that the NRF meets the needs of all stakeholders who have 
a role in its effective implementation, it is essential that DHS fully 
collaborate with non-federal stakeholders in its development and revision. 
DHS initially involved non-federal stakeholders in the revision of the 2004 
Plan but omitted a key step in its work plan by not obtaining and 
incorporating their comments on the first full draft. Instead, DHS 
undertook a closed, internal federal review of the draft that lasted about 5 
months with little communication with the non-federal partners. The 
result was a breach of trust with DHS's non-federal partners in the drafting 
process. 
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The Post-Katrina Act gives responsibility for maintaining and updating the 
NRF to FEMA and charges the Administrator's National Advisory Council 
with incorporating non-federal stakeholder input into the NRF's 
development and revision. Established too late to fulfill this role in the 
creation of the current NRF, the NAC is now functioning, and it is 
important that there be compatible policies and procedures for how the 
NAC will fulfill its statutory charge. 

Contrary to effective government internal control and management 
principles, FEMA has not yet developed policies and procedures for 
guiding future revisions of the NRF, including specifying the conditions 
and time frames under which FEMA would review and revise the NRF and 
how FEMA will involve the NAC and collaborate with other non-federal 
stakeholders. Especially in view of a new administration, non-federal 
stakeholder participation and ownership is essential in any revision of the 
NRF, and the lessons learned from the process for revising the 2004 Plan 
will apply in the future to FEMA's and DHS's efforts to develop and revise 
other national plans and policies that make up the national preparedness 
system. While the NRF is published by DHS, it belongs to the nation's 
emergency response community that is collectively responsible for 
effectively implementing the NRF's provisions should another catastrophic 
disaster like Hurricane Katrina occur. 



Recommendation for 
Executive Action 



We recommend that the FEMA Administrator develop and disseminate 
policies and procedures that describe (1) the circumstances and time 
frames under which the next NRF revision will occur and (2) how FEMA 
will conduct the next NRF revision, including how its National Advisory 
Council and other non-federal stakeholders — state, local, and tribal 
governments; the private sector; and nongovernmental organizations — will 
be integrated into the revision process and the methods for 
communicating with these stakeholders. 



ASenCV Comments ^ 6 re( l ues t ec ' comments on a draft of this report from DHS and FEMA. 

" They concurred with our recommendations and had no other comments. 

We are sending copies of this report to the Secretary of Homeland 
Security, FEMA Administrator, and interested congressional committees. 
We will also provide copies to others on request. If you or your staff have 
any questions about this report or wish to discuss the matter further, 
please contact me at (202) 512-8777 orjenkinswo@gao.gov. Contact points 
for our Offices of Congressional Relations and Public Affairs may be found 
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on the last page of this report. See appendix IV for a list of key 
contributors to this report. 




William O. Jenkins, Jr. 

Director, Homeland Security and Justice Issues 



Page 29 



GAO-08-768 FEMA's National Response Framework 



Appendix I: Scope and Methodology 



This report addresses the following questions: (1) To what extent did the 
Department of Homeland Security (DHS) collaborate with non-federal 
stakeholders in revising and updating the December 2004 National 
Response Plan into the January 2008 National Response Framework 
(NRF)? (2) To what extent has FEMA developed policies and procedures 
for managing future revisions of the NRF? 

To address these questions, we interviewed DHS, FEMA, and non-federal 
stakeholders who were directly involved in the revision and update of the 
2004 Plan into the 2008 NRF, and we reviewed DHS and FEMA documents 
on the revision process. Because there were over 700 federal and non- 
federal officials who participated in the Steering Committee and Work 
Groups, we interviewed those who held key positions. The FEMA officials 
and non-federal stakeholders we interviewed held key positions in the 
revision process, such as the FEMA Administrator and Deputy 
Administrator and the two FEMA co-chairs of the Steering Committee. The 
non-federal stakeholders we interviewed included four of the five non- 
federal officials who served as Steering Committee members and all three 
of the non-federal officials who served as co-leaders of Work Groups; 
these non-federal stakeholders also held positions in state, county, and 
city governments and non-governmental organizations. 

To determine the extent to which DHS collaborated with non-federal 
stakeholders, we first determined the revision process that DHS had 
planned to follow to revise the 2004 Plan. We reviewed DHS's September 
2006 revision work plan that had been approved by the Domestic 
Readiness Group of White House's Homeland Security Council and 
interviewed FEMA and non-federal officials who served in key positions in 
the revision process. We also reviewed applicable statutes, primarily the 
October 2006 Post-Katrina Emergency Management Reform Act, for 
statutory requirements related to the revision process. To determine what 
happened during the revision process and the extent to which DHS 
involved non-federal stakeholders in that process, we interviewed FEMA 
officials and non-federal stakeholders who served in key positions in the 
revision process and the chairman of FEMA's National Advisory Council 
(NAC). Further, we reviewed DHS documentation citing the roles provided 
to non-federal stakeholders in the revision process and explaining how the 
actual revision process was conducted, FEMA documentation on the 
process and time frames related to the NAC's establishment, NAC 
documentation regarding its role in the revision process, and 
congressional testimony from non-federal stakeholders on how DHS 
conducted and included them in the revision process. To determine the 
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Appendix I: Scope and Methodology 



extent to which FEMA had policies and procedures in place for future 
revisions of the NRF, we interviewed FEMA officials. 

The non-federal officials we interviewed represented state and local levels 
of government, emergency management associations, and other non- 
federal entities. While the statements and views of the stakeholders we 
interviewed are not generalizable to the some 230 non-federal 
stakeholders involved in the revision process, we chose to speak to them 
because of their assigned key roles. 

There is some uncertainty in our determination of the total number of non- 
federal members in the 12 Work Groups, and thus the total number of 
Work Group members, due to duplication or the lack of adequate 
information identifying a member as federal in the data provided by 
FEMA. However, because DHS's inclusion of non-federal members in the 
revision process is the focus of this report, we took steps to correctly 
determine the number and composition of the 224 non-federal members. 
Based on our analysis of FEMA's data for federal members, we believe the 
total of 486 federal members is a reasonable approximation, and therefore, 
the grand total of 710 Work Group members is also a reasonable 
approximation. 
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Appendix II: The 17 Key Revision Issues That 
DHS Identified for the 2004 National 
Response Plan 



In the 2004 National Response Plan revision work plan approved by the 
Domestic Readiness Group, a White House Homeland Security Council- 
chaired policy committee, in September 2006, DHS identified 14 key issues 
that it wanted the revision process to address. According to FEMA 
officials, these issues were compiled by reviewing Hurricane Katrina after- 
action and lessons-learned reports from the White House, Congress, GAO, 
and DHS's Inspector General and identifying common issues that were 
raised in multiple reports. The work plan directed DHS to conduct 
meetings with stakeholders to review the initial list and identify other 
issues to be considered during the revision process. These issues were to 
serve as the starting point from which the 2004 Plan revision would be 
conducted. DHS held meetings with non-federal stakeholder and federal 
stakeholders in October and November 2006 respectively. After these 
meetings, DHS identified three additional revision issues to its initial list 
contained in the approved work plan. The 17 key revision issues are listed 
below — the 3 issues added after the stakeholder meetings are indicated 
with a note. 



The revision issues are categorized by whether they were to be addressed 
in either the 2004 Plan base document or its annexes. The 2004 Plan 
comprised four major components: the Base Plan, Emergency Support 
Function Annexes, Support Annexes, and Incident Annexes. The Base 
Plan provided an overview of the structure and processes comprising a 
national approach to domestic response actions. The 15 Emergency 
Support Function Annexes detailed the missions, policies, structures, and 
responsibilities of federal agencies for coordinating resource and 
programmatic support, such as mass care and shelter, to states, tribes, and 
other federal agencies or other jurisdictions and entities. The nine Support 
Annexes provided guidance and described the functional processes and 
administrative requirements necessary to ensure the 2004 Plan's efficient 
and effective implementation. The seven Incident Annexes addressed 
contingency or hazard situations requiring specialized application of the 
2004 Plan, such as biological, catastrophic, and nuclear/radiological 
incidents. 



The key revision issues identified for the 2004 National Response Plan 
base document were 



• clarify roles and responsibilities of key structures, and positions, and 
levels of government; 

• strengthen role of states and private sector; 
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Appendix II: The 17 Key Revision Issues That 
DHS Identified for the 2004 National 
Response Plan 



• integrate National Incident Management System concepts, principles, 
terminology, systems, and organizational processes into the revised 
National Response Plan; 

• review Joint Field Office structure and operations, to include Unified 
Command; and 

• incorporate proactive planning for incidents that render state and local 
governments incapable of an effective response. 

The key revision issues identified for the annexes to the 2004 National 
Response Plan base document were 

• examine all existing National Response Plan annexes and proposed new 
annexes, 

• strengthen External Affairs and Public Affairs Annexes; 

• review logistics management issues, 1 

• examine evacuation and sheltering issues, 2 

• ensure the integration of all search and rescue assets, 

• review the scope of public safety and security missions, 

• incorporate companion animal issues, 

• improve process for identifying and accepting donated goods and the 
integration of volunteers, 

• clarify international support mechanisms, 

• ensure consistency with National Emergency Communication Strategy, 

• refine the Catastrophic Incident Supplement to include the review of a 
possible increased Department of Defense responsibility, and 

• review federal incident management plans and determine their 
appropriate linkage to the National Response Plan. 3 



\ This issue was added after DHS presented the initial 14 key revision issues identified in 
the work plan at stakeholder meetings with non-federal and federal stakeholders in 
October and November 2006. 

2 See footnote 1. 

3 See footnote 1. 
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Appendix III: The 12 Work Groups DHS 
Established during the Revision Process and 
Their Composition 



The 2004 National Response Plan revision work plan approved by the 
Domestic Readiness Group in September 2006 directed DHS to establish 
Work Groups to rewrite portions of the 2004 Plan. While the work plan did 
not specify the number of Work Groups that should be established, DHS 
formed 12 Work Groups that were co-led by federal officials or a 
combination of federal and non-federal officials. The 12 Work Groups 
were 

• Catastrophic Planning, 

• Communications, 

• Companion Animals, 

• Evacuations and Sheltering (co-led by non-federal stakeholder), 

• Functions, 

• Incident Management and Coordination, 

• International Support, 

• National Incident Management System, 

• Roles and Responsibilities (co-led by non-federal stakeholder), 

• Special Needs, 

• Training and Implementation, and 

• Volunteer and Donation Management (co-led by non-federal stakeholder). 

Of the 709 members who served on the 12 Work Groups, 224 officials, or 
32 percent, were non-federal. These non-federal stakeholders included 
representatives from state, tribal, and local government as well as the 
private sector and nongovernmental organizations. Further, the non- 
federal stakeholders came from various occupational sectors. See table 1 
for a description of these 224 non-federal stakeholders. 
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Appendix III: The 12 Work Groups DHS 
Established during the Revision Process and 
Their Composition 



Table 1 : The 224 Non-Federal Stakeholders Who Participated in the Revision Work Groups by Occupational Sector and by 
Level of Government, Nongovernmental Organization, and Private Sector 



Level of government 



Occupational sector" 


Local 


Tribal 


State 


Nongovernmental 
organization 


Private 
sector 


Total 


Animal, plant and food" 


2 




5 


12 


2 


21 


Critical infrastructure 


1 






3 


11 


15 


Disaster assistance services" 








24 




24 


Elected government officials 




1 








1 


Emergency management and homeland security 8 


7 


7 


40 


8 


4 


66 


Emergency medical providers and health sector 1 


5 




8 


9 




22 


Fire and search and rescue 


4 






3 




7 


General business 3 










12 


12 


General government 11 


3 










3 


Logistics and transportation 1 


1 




1 


2 


3 


7 


Military and national security related' 






3 




2 


5 


Police and corrections 


10 




3 


2 




15 


Special needs populations* 


1 






7 




8 


Standards and accreditation bodies 















Volunteerism and voluntary organizations' 






7 


8 




15 


Unidentified" 1 


1 


1 




1 




3 


Total non-federal stakeholders 


35 


9 


67 


79 


34 


224 



Source: GAO analysis of FEMA data. 

a We developed this list of occupational sectors based on our analysis and categorization of the 
entities these 224 non-federal stakeholders represented. 

"Includes agriculture, animal control, animal health & welfare, food production and security, and 
veterinary associations. 

Includes communications, cybersecurity, information technology, public works, and water. 

"Includes emergency food support, Red Cross, and religion-based assistance services. 

"Includes business continuity, contingency planning, crisis management, and risk analysis. 

'Includes emergency medical technicians, health officials, pharmacists and physicians associations; 
health departments and systems; and medical aviation. 

"Includes Chambers of Commerce, commodities trading, general consulting firms, public relations, 
and trade associations. 

"Includes cities association, city managers association, and city officials. 

includes package delivery services, revenue collection, supply-chain management, and mass transit. 
'Includes civilian air patrol, military affairs, and a national security related business association. 
Includes children, disabilities, and low income housing. 



Page 35 



GAO-08-768 FEMA's National Response Framework 



Appendix III: The 12 Work Groups DHS 
Established during the Revision Process and 
Their Composition 



'Includes national, state, and local agencies that coordinate individual volunteers or coordinate 
voluntary organizations. 

"■Unidentified means that we were able to determine the non-federal stakeholder's level of 
government, nongovernmental organization, or the private sector, but we could not determine the 
stakeholder's occupational sector. We excluded one unidentified non-federal stakeholder from this 
table for whom we could neither determine the individual's occupational sector nor level of 
government, a nongovernmental organization, or the private sector. 
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